feat: validate CanvasEngine 2.1 and formalize GUI boundaries

[RSamaium]

What changed

• upgrade CanvasEngine runtime, compiler, presets, testing and tiled integrations to the latest compatible 2.1 releases across packages, samples and playgrounds
• formalize renderer-neutral GUI registrations with explicit canvas / vue ownership and add the vueGui() helper while preserving legacy inference
• add the official @rpgjs/chat v5 beta module with server-authoritative validation, moderation, rate limiting and replaceable CanvasEngine/Vue presentation
• add shared chat CSS primitives plus default/pixel theme exports and a common-markup contract test
• add executable production bundle fixtures that cover direct imports, re-exports, dynamic imports and sourcemaps while rejecting client rendering code from server output
• accept ADR 003, document the new contracts, refresh the public API boundary snapshot and add dedicated changesets
• make the shared test setup deterministic on Node 26 where the optional native localStorage accessor otherwise shadows jsdom

Why

RPGJS v5 needs a verified CanvasEngine baseline and enforceable boundaries between authoritative gameplay, GUI renderer choice and feature-owned UI. This establishes CanvasEngine 2.1 as that baseline without changing @rpgjs/physic, and makes the architectural decision testable in CI.

Validation

• pnpm install --frozen-lockfile
• pnpm build — all 12 packages
• pnpm test -- --run — 151 files, 1,092 passed, 19 skipped
• pnpm test:types — 19 passed, no type errors
• pnpm api:boundary — 27 public TypeScript entries, no reachable Signe type
• pnpm --filter '@rpgjs/playground-*' --filter sample run build — all 10 builds
• focused GUI, Vue, chat, theme and production bundle-isolation tests — 33 passed
• official rpgjs/starter v5 validated with packed local packages: production build passed, fixed-port dev server started, canvas and map requests observed, keyboard interaction exercised, no page error or failed request

The starter still reports its existing src/theme-default/theme.css path warning and renders a black headless screenshot; both results were reproduced unchanged with the currently published packages. Existing chunk-size warnings are also unchanged.